A plain, JSON-serializable snapshot of every default header set on this instance via transactor/on so far — same "only plain data survives JSON.stringify" reasoning as cookies, just for header/token-based auth (e.g. Authorization: Key <api_key>) instead of cookie-based auth. The host reads this off exec_login's result and threads it back as hostArgs.user_agent_headers, rehydrated the same way user_agent_cookies is (issue #78/#93 — before this field existed, a login plugin authenticating via a header rather than a cookie had no way to pass that credential to a downstream metadata/download call at all: nhapiauth's Authorization header was silently dropped crossing this exact boundary).